1. Field of the Invention
The present invention is related generally to a data processing system and in particular to a method and apparatus for encryption. More particularly, the present invention is directed to a computer implemented method, apparatus, and computer usable program code for introducing an encryption facility into a virtual file systems layer for encrypting files in heterogeneous file systems.
2. Description of the Related Art
A file is a resource for storing information and/or data in a computer. A file system is a method or data structure for organizing and managing computer files. A file system provides a better way for organizing files on the computer, physically and logically. There are many different types of file systems currently available, including but not limited to, Unix® file system (UFS), and Veritas® file system (VFS). A computer system that includes two or more different types of file systems is a heterogeneous file system.
Data stored in files on a file system are frequently of a sensitive nature such that it is desirable to prevent some users of the computer system from being able to access the data. For example, files in a bank computer system might include customer financial account information that needs to be protected from access by the general public and employees without a given security clearance level. File encryption reduces the risk of unauthorized access to sensitive data.
Encryption refers to encoding, enciphering, or obfuscating data such that the data is unintelligible to unauthorized users. Encryption and de-encryption is typically achieved by using a key or secret code. Encrypting data prevents the data from being read or interpreted by users who do not possess the correct secret key, thus disallowing malicious insecure data access. If the same key is used to encrypt and de-encrypt data, the encryption is referred to as symmetric encryption. If different keys are used to encrypt and de-encrypt data, the encryption is referred to as asymmetric encryption. Public key encryption and private key encryption are two traditional cryptographic methods available for securing data.
Encrypted file systems provide core file encryption technology used to store encrypted files on the file system. However, multiple disparate cryptographic file system models exist. In a heterogeneous file system, this can lead to multiple different encryption methods or models in use among the various file systems.
For example, volume encryptors use the device driver layer to encrypt and de-crypt information written to and read from a physical disk. Volume encryptors encrypt whole drives and are transparent to the end user. Volume encryptors include systems such as secure file system (SFS) and ScramDisk. However, volume encryptors do not provide fine-grained control to allow users to select to encrypt some individual directories and files and select to not encrypt other directories and files. In other words, volume encryptors do not provide granular encryption as the file level.
File encryptors operate at the application or presentation layer to provide end-to-end file encryption. In order to provide some sort of transparency to the user, file encryptors typically require some measure of application rewrite in order to support encryption. File encryptor systems include tools such as pretty good privacy (PGP). However, file encryptors are intended to operate on small numbers of files. File encryptors do not scale well to storage systems. In addition, file encryptors operate in the user memory space, whereas virtual file systems and the operating system kernel operate in the kernel memory space. Therefore, copy-in and copy-outs of data from the user memory space to the kernel memory space would be necessary when implementing file encryptors during write-in and read-out operations on files which would decrease processing efficiency.
File system encryptors allow the encryption of files on a per-file or a per-directory basis using a single key. One implementation of a cryptographic file system is through the use of a kernel resident file system. Using this encryption facility, a file system can be mounted on any directory, as well as on top of a different file system, such as UFS or NFS. This model removes the need for additional daemon processes that may be exploited to gain access to the file system or possibly to the files. This implementation model is used by CryptFS. In CryptFS, the interface is provided through a stackable virtual node (V-node). V-nodes can be used to represent an open file, directory, device, or other objects. V-nodes do not express what type of physical file system they implemented.
V-node stacking allows for file system modularization where one V-node interface calls another V-node interface. Each V-node operation in CryptFS calls its next-lower layer function for file system specific operations. CryptFS inserts itself on top of any directory, encrypts file data before it is passed the file system, and de-encrypts it in the reverse direction. However, file system encryptors like CryptFS do not permit files to be designated as non-encrypted files. In other words, file system encryptors encrypt all files in the file system.
True Crypt is an open source disk encryption software. True Crypt creates a virtual encrypted disk within a file and mounts it as a real disk. True Crypt can also encrypt an entire hard disk partition. However, True Crypt only allows creation of new encrypted file systems. True Crypt does not provide for fine granularity and selectively encrypting some files and directories but not encrypting other files and directories.
There are a few third party tools or applications available which act as kernel extensions that sit on top of the kernel, thereby gaining kernel authority and/or privileges to perform encryption operations. These kernel extensions behave like a driver with “crypto” features for encryption and decryption. However such kernel extensions are also built on V-node stacking techniques and have their own limitations as discussed above. These methods will also result in non portable kernel modules in heterogeneous environments.